--- title: Vlt 1.0 and Hosted Package Registries | daily.dev description: vlt has reached 1.0 with a stable client release and general availability of hosted package registries and ecosystem mirrors. The client is a drop-in npm... canonical: https://daily.dev/posts/vlt-1-0-and-hosted-package-registries-krdgtxh5p twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Vlt 1.0 and Hosted Package Registries | daily.dev og:description: vlt has reached 1.0 with a stable client release and general availability of hosted package registries and ecosystem mirrors. The client is a drop-in npm... og:url: https://daily.dev/posts/vlt-1-0-and-hosted-package-registries-krdgtxh5p og:image: https://api.daily.dev/og/posts/KrDGTxh5p.png og:image:alt: Vlt 1.0 and Hosted Package Registries og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Vlt 1.0 and Hosted Package Registries **[Hacker News](https://daily.dev/sources/hn)** · 4 min read · 2 upvotes · 1 comments ## Summary vlt has reached 1.0 with a stable client release and general availability of hosted package registries and ecosystem mirrors. The client is a drop-in npm replacement featuring 60+ graph-native pseudo selectors (including security-focused ones like :malware, :cve, :vuln), phased installations that block known malware by default, graph modifiers, catalogs for centralized dependency management, and OIDC trusted publishing. The hosted registry is backwards compatible with npm, pnpm, yarn, bun, and deno, offers a generous free tier, serves packages from edge infrastructure (up to 38% faster cold installs than npm), and actively blocks malicious packages — having flagged over 275k package versions, with 25% still available on the public npm registry. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is vlt and how is it different from npm? vlt is a security-first package manager that works as a drop-in replacement for npm, running the full package lifecycle (install, build, run, publish) without needing npm as a fallback. It adds over 60 graph-native query selectors such as :malware, :cve, and :outdated, supports OIDC trusted publishing without long-lived tokens, and blocks known malware during installation by default. _Developers weighing package manager options can track releases like vlt on daily.dev before switching tooling._ ### How much faster is vlt's package registry compared to the standard npm registry? Clean installs through vlt's hosted registry run up to 38% faster than npm, according to vlt's own benchmarks, with no changes required to existing tooling. Packages are served from edge infrastructure located near developers and CI systems to reduce cold installation latency, which matters for ephemeral sandboxes and agentic development workflows. _Engineers optimizing CI install times can follow registry performance benchmarks like this on daily.dev._ ### How many malicious npm packages has vlt flagged and blocked? Over 275,000 package versions have been flagged as malicious, with more than 25% of those still actively available for download on the public npm registry at the time of reporting. vlt ingests public malware feeds and advisory databases, including OSV, to block known-bad packages during indexing rather than after malicious payloads are delivered. _Teams hardening their supply chain against malicious packages can follow security findings like this on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 19 comments across hackernews (as of 2026-09-14). **TL;DR:** The community is cautiously interested but largely confused about vlt's core value proposition — multiple commenters struggled to understand what it actually is after reading the announcement, while those familiar with the space (including a Netflix JS platform engineer) are more enthusiastic about its security and performance goals. **Sentiment:** 40% positive · 45% mixed · 15% skeptical **The case for** - A Netflix JS platform engineer vouches for the team's credibility, noting they shipped npm's most important modern features before going independent. - The registry claims 10–40% faster cold installs than npm out-of-the-box and ~3x faster than incumbent enterprise registries, with public benchmarks linked. - Active malware blocking — over 275k flagged package versions, with 25% still live on the public npm registry — is seen as a meaningful supply chain improvement. - OIDC trusted publishing support in the client is noted as a step up from legacy npm clients. **The pushback** - Multiple commenters independently complained they couldn't understand what vlt actually is after reading the announcement and the post itself. - The hosted registry lacks identity federation via OIDC (server-side), which one commenter says makes it not a real Verdaccio replacement yet. - The landing page doesn't even mention JavaScript, making the product's scope unclear to newcomers. **By community** - hackernews (mixed): Genuine interest from those already in the JS ecosystem, but repeatedly undercut by confusion over the product's identity and a lack of a clear, concise pitch on the announcement page itself. **Hottest debate:** Whether vlt's announcement page communicates its value proposition clearly enough — several commenters asked independently what the product actually is, even after reading it. **Open questions** - When will server-side OIDC identity federation land on the hosted registry? - How does performance compare specifically to pnpm (not just npm)? - Will vlt expand beyond JavaScript to other ecosystems like Python? **Highlights** > To add a bit of non-Vlt (I work on the JS Platform Team at Netflix where I have driven many of our decisions in the package manager space the past 6 years) but highly involved and supportive community member: The team that was able to ship the most important features for npm to be competitive in the modern JS stack from ~2020 was able to take a fresh look at the problem without the organizational baggage of Github/Microsoft. On the technical side, the ecosystem is maturing and we need a better set of foundational tools to meet that maturity level. This includes deep commitment to performance, security, and DX. The full product is more than just a package manager, it is a registry, a registry client, a task runner, and much more. Vlt is aiming to be this mature foundation. Feel free to correct me if I am wrong on anything here Darcy. P.S. grumble grumble...jFrog is a trash fire....grumble grumble > — [wesleytodd on hackernews](https://news.ycombinator.com/item?id=49174897) > ...can you make the 5s pitch be more like 'X times faster than pnpm and more secure' but fill X for me? unless it isn't pnpm at all in which case replace with 'it does X' because I've no idea after reading your post and a quick skim of the announcement itself? > — [baq on hackernews · 1 comments](https://news.ycombinator.com/item?id=49174966) > The entire page doesn't even mention javascript :/ > — [boxed on hackernews](https://news.ycombinator.com/item?id=49176296) > Without identity federation via oidc it’s basically not really a replacement for verdaccio > — [merb on hackernews · 1 comments](https://news.ycombinator.com/item?id=49173153) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49172251) · 49 points · 19 comments ## Community discussion Top comments from developers on daily.dev. **@agustinbarrientos** · 1 upvotes > I'd put malware blocking at the registry and stop asking every team to bolt on another scanner after the fact. ## Similar posts on daily.dev - [vlt 1.0 Ships as a Drop-in npm Replacement with Phased Installs, Graph Queries, and Malware-Blocking](https://daily.dev/posts/vlt-1-0-ships-as-a-drop-in-npm-replacement-with-phased-installs-graph-queries-and-malware-blocking-glqamnuky) · InfoQ · 0 upvotes · 0 comments - [Package Manager Trends](https://daily.dev/posts/package-manager-trends-kqoxafzlm) · Andrew Nesbitt · 8 upvotes · 1 comments - [Introducing Secure Registry: install-time defense for the npm supply chain](https://daily.dev/posts/introducing-secure-registry-install-time-defense-for-the-npm-supply-chain-whugo2iji) · StepSecurity · 0 upvotes · 0 comments - [pnpm 11.23](https://daily.dev/posts/pnpm-11-23-migxmswxe) · Fast, disk space efficient package manager \| pnpm · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/vlt-1-0-and-hosted-package-registries-krdgtxh5p) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Vlt 1.0 and Hosted Package Registries","url":"https://daily.dev/posts/vlt-1-0-and-hosted-package-registries-krdgtxh5p","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/vlt-1-0-and-hosted-package-registries-krdgtxh5p"},"datePublished":"2026-08-04T19:34:58.790Z","dateModified":"2026-09-14T06:03:34.292Z","description":"vlt has reached 1.0 with a stable client release and general availability of hosted package registries and ecosystem mirrors. The client is a drop-in npm...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a22e2997c3a6e154949d1077d12bcd7e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a22e2997c3a6e154949d1077d12bcd7e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/vlt-1-0-and-hosted-package-registries-krdgtxh5p","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,npm","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Vlt 1.0 and Hosted Package Registries"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/vlt-1-0-and-hosted-package-registries-krdgtxh5p","comment":[{"@type":"Comment","text":"I’d put malware blocking at the registry and stop asking every team to bolt on another scanner after the fact.","datePublished":"2026-08-06T04:22:53.298Z","url":"https://daily.dev/posts/KrDGTxh5p#c-eiHHvV8yy","author":{"@type":"Person","name":"Agustin Barrientos","url":"https://daily.dev/agustinbarrientos","image":"https://media.daily.dev/image/upload/s--5ayxQnqn--/f_auto/v1788281802/avatars/avatar_wQYYVe5Tbj0NJ7C7qPoa8?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/vlt-1-0-and-hosted-package-registries-krdgtxh5p#faq","mainEntity":[{"@type":"Question","name":"What is vlt and how is it different from npm?","acceptedAnswer":{"@type":"Answer","text":"vlt is a security-first package manager that works as a drop-in replacement for npm, running the full package lifecycle (install, build, run, publish) without needing npm as a fallback. It adds over 60 graph-native query selectors such as :malware, :cve, and :outdated, supports OIDC trusted publishing without long-lived tokens, and blocks known malware during installation by default. Developers weighing package manager options can track releases like vlt on daily.dev before switching tooling."}},{"@type":"Question","name":"How much faster is vlt's package registry compared to the standard npm registry?","acceptedAnswer":{"@type":"Answer","text":"Clean installs through vlt's hosted registry run up to 38% faster than npm, according to vlt's own benchmarks, with no changes required to existing tooling. Packages are served from edge infrastructure located near developers and CI systems to reduce cold installation latency, which matters for ephemeral sandboxes and agentic development workflows. Engineers optimizing CI install times can follow registry performance benchmarks like this on daily.dev."}},{"@type":"Question","name":"How many malicious npm packages has vlt flagged and blocked?","acceptedAnswer":{"@type":"Answer","text":"Over 275,000 package versions have been flagged as malicious, with more than 25% of those still actively available for download on the public npm registry at the time of reporting. vlt ingests public malware feeds and advisory databases, including OSV, to block known-bad packages during indexing rather than after malicious payloads are delivered. Teams hardening their supply chain against malicious packages can follow security findings like this on daily.dev."}}]} ```